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Mission 

Our  mission  is  to  provide  independent,  relevant,  and  timely 
oversight  of  the  Department  that:  supports  the  warfighter; 
promotes  accountability,  integrity,  and  efficiency;  advises  the 
Secretary  of  Defense  and  Congress;  and  informs  the  public. 


Vision 

Ourvision  is  to  be  a  model  oversight  organization  in  the  federal 
government  by  leading  change,  speaking  truth,  and  promoting 
excellence;  a  diverse  organization,  working  together  as  one 
professional  team,  recognized  as  leaders  in  our  field. 


Fraud,  Waste  and  Abuse 

HOTLINE 

1.800.424.9098  •  www.dodig.mil/hotline 


For  more  information  about  the  whistleblower  protection,  please  see  the  inside  back  cover. 
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DEPARTMENT  OF  DEFENSE 
4800  MARK  CENTER  DRIVE 
ALEXANDRIA,  VIRGINIA  22350-1500 


MEMORANDUM  FOR  DIRECTOR,  DEFENSE  CONTRACT  MANAGEMENT  AGENCY 

SUBJECT:  Quality  Control  Review  of  the  Defense  Contract  Management  Agency  Internal 
Review  Audit  Function  (Report  No.  DoDIG 

We  are  providing  this  report  for  your  information  and  use.  We  have  reviewed  the  Defense 
Contract  Management  Agency  (DCMA)  Internal  Review  Team’s  (IRT)  system  of  quality  control 
in  effect  for  the  period  ended  May  30,  2012.  A  system  of  quality  control  for  DCMA’s  audit 
function  encompasses  the  audit  organization’s  leadership,  emphasis  on  performing  high  quality 
work,  and  policies  and  procedures  established  to  provide  reasonable  assurance  of  compliance 
with  generally  accepted  government  audit  standards  (GAGAS).  The  DCMA  IRT  is  responsible 
for  designing  a  system  of  quality  control  and  complying  with  its  system  to  provide  DCMA 
management  with  reasonable  assurance  that  its  audits  are  performed  and  reported  on  in 
accordance  with  GAGAS  in  all  material  respects. 

We  conducted  our  review  in  accordance  with  GAGAS  and  guidelines  established  by  the  Council 
of  the  Inspectors  General  on  Integrity  and  Efficiency  (CIGIE).  We  tested  the  DCMA’s  IRT 
organization’s  system  of  quality  control  to  the  extent  we  considered  appropriate.  GAGAS 
require  that  an  audit  organization  performing  audits  or  attestation  engagements  or  both  have  an 
appropriate  internal  quality  control  system  in  place  and  undergo  an  external  quality  control 
review  at  least  once  every  3  years  by  reviewers  independent  of  the  audit  organization  being 
reviewed.  An  audit  organization’s  quality  control  policies  and  procedures  should  be 
appropriately  comprehensive  and  suitably  designed  to  provide  reasonable  assurance  that  they 
meet  GAGAS  requirements  for  quality  control. 

Federal  audit  organizations  can  receive  a  rating  of  pass,  pass  with  deficiencies ,  or  fail.  In  our 
opinion,  the  DCMA  IRT  organization’s  system  of  quality  control  for  audits  was  suitably 
designed  in  accordance  with  the  quality  standards  established  by  GAGAS.  Accordingly,  we  are 
issuing  a  pass  opinion  on  DCMA’s  audit  organization  for  the  period  ended  May  30,  2012. 

In  addition  to  reviewing  its  system  of  quality  control  to  ensure  adherence  with  GAGAS,  we 
applied  certain  limited  procedures  in  accordance  with  guidance  established  by  the  CIGIE  related 
to  DCMA  IRT’s  monitoring  of  engagements  performed  by  Independent  Public  Accountants 
(IP A)  under  contract  where  the  IPA  served  as  the  principal  auditor.  It  should  be  noted  that 
monitoring  of  engagements  performed  by  an  IPA  is  not  an  audit  and  therefore,  is  not  subject  to 
the  requirements  of  GAGAS.  The  purpose  of  our  limited  procedures  was  to  determine  whether 
DCMA  IRT  had  controls  to  ensure  the  IPA  performed  contracted  work  in  accordance  with 
professional  standards.  However,  our  objective  was  not  to  express  an  opinion  and  accordingly, 
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we  do  not  express  an  opinion  on  DCMA’s  monitoring  of  work  performed  by  the  IP  A. 
Appendix  A  contains  background,  comments  and  observations,  and  recommendations  for 
DCMA  to  improve  its  quality  control  system.  Appendix  B  contains  our  review  results  of  the 
monitoring  of  the  independent  public  accountants.  Appendix  C  contains  a  summary  of  the 
results  of  our  interviews  with  the  DCMA  IRT  audit  staff.  Appendix  D  contains  the  scope  and 
methodology  of  the  review. 

We  appreciate  the  courtesies  extended  to  the  staff.  For  additional  information  on  this  report, 
please  contact  Ms.  Carolyn  R.  Davis  at  (703)  604-8877  (DSN  664-8877),  or 
Carolyn.Davis@dodig.mil. 


Randolph  R.  Stone 
Deputy  Inspector  General 
Policy  and  Oversight 
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Appendix  A 

Background,  Comments  and  Observations, 
and  Recommendations 

Background 

Defense  Contract  Management  Agency 

The  Defense  Contract  Management  Agency  (DCMA)  is  the  DoD  component  that  works 
directly  with  Defense  suppliers  to  help  ensure  that  DoD,  Federal,  and  allied  government 
supplies  and  services  are  delivered  on  time,  at  projected  cost,  and  meet  all  performance 
requirements.  As  of  September  30, 2012,  DCMA  employed  10,478  civilian  and  538  military 
personnel,  included  3  operations  directorates  and  46  contract  management  offices,  and 
oversaw  20,296  contractors  with  344,000  active  contracts. 

DCMA  Internal  Review  Team 

The  DCMA  Internal  Review  Team  (IRT)  is  part  of  the  DCMA  Office  of  Independent 
Assessment.  The  Office  reports  directly  to  the  Director  of  DCMA.  The  DCMA  IRT  has  two 
primary  mission  components: 

•  conduct  internal  reviews  (auditing)  of  administrative  support  programs, 
systems,  and  processes  to  include  determining  the  adequacy  of  existing 
management  controls,  forming  appropriate  conclusions,  and  making 
applicable  recommendations  to  the  Director  of  DCMA  and 

•  perform  external  audit  liaison,  coordination,  and  audit  advisory  services. 

The  Office  consists  of  a  supervisory  auditor,  one  external  liaison  administrator,  and  six 
auditors.  The  DCMA  IRT  began  performance  auditing  in  FY  2009.  The  DCMA  IRT  published 
its  first  Audit  Manual  on  April  30, 2010,  and  revised  the  Audit  Manual  on  January  6, 2012. 1 

Comments  and  Observations 

We  are  issuing  a  pass  opinion  because  we  determined  that  the  system  of  quality  control 
for  the  DCMA  IRT  is  adequately  designed  and  functioning  as  prescribed.  The  findings  we 
identified  during  our  review  of  the  selected  audit  reports  were  not  cumulatively  significant 
enough  to  rise  to  the  level  of  a  deficiency  or  significant  deficiency,  based  on  our  opinion 
and  as  defined  by  the  Council  of  the  Inspectors  General  on  Integrity  and  Efficiency  (CIGIE) 


1  Due  to  the  timeframe  of  this  review,  we  applied  the  DCMA  Audit  Manual,  April  30,  2010,  for  reviews  of  audits. 
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Guide  for  Conducting  External  Peer  Reviews  of  the  Audit  Organizations  of  Federal  Offices 
of  Inspector  General  (CIGIE  Guide). 

We  judgmentally  selected  two  reports  to  review  for  compliance  with  generally  accepted 
government  auditing  standards  (GAGAS)  in  nine  areas:  quality  control,  independence, 
professional  judgment,  competence,  audit  planning,  supervision,  evidence,  audit 
documentation,  and  reporting.  In  addition,  we  selected  one  audit  in  which  DCMA 
performed  monitoring  of  an  independent  public  accounting  firm  for  compliance  with  the 
CIGIE  Guide. 

We  identified  five  areas  with  findings  relating  to  the  quality  control  system,  independence, 
planning,  audit  documentation,  and  quality  control  of  audits.  In  addition,  we  made 
recommendations  in  relation  to  the  monitoring  of  independent  public  accountants 
(Appendix  B).  The  review  of  the  monitoring  of  the  Independent  Public  Accountants  (IPA) 
does  not  affect  the  opinion  of  the  DCMA  IRT  quality  control  review. 

Quality  Control  Monitoring 

During  the  period  of  our  review,  the  DCMA  IRT  did  not  have  an  overall  plan  for  quality 
control  monitoring.  The  DCMA  IRT  performed  some  quality  control  procedures  to  include 
updating  sections  of  the  Audit  Manual  and  performing  reviews  of  previous  audits.  Also, 
the  Director,  DCMA,  initiated  an  intra-agency  peer  review  of  its  internal  audit  mission  and 
IRT  in  June  2011  because  a  previous  review  had  not  been  done.  DCMA  employees  who 
had  experience  as  former  Federal  agency  auditors  with  a  working  knowledge  of  GAGAS 
performed  the  review. 

As  part  of  the  quality  control  monitoring,  we  found  that  a  checklist  was  used  for  one  review 
of  an  audit;  however,  for  another  review,  only  a  summary  of  the  review  was  provided, 
but  the  checklist  supporting  the  review  could  not  be  located.  In  addition,  follow-up  on 
quality  control  monitoring  was  not  performed  to  identify  whether  deficiencies  found  in 
the  reviews  of  audits  were  addressed. 

GAGAS  3.532  states  that  audit  organizations  should  establish  policies  and  procedures 
for  monitoring  of  quality  in  the  audit  organization.  Further,  GAGAS  3.54  states  the  audit 
organization  should  analyze  and  summarize  the  results  of  its  monitoring  process  at  least 
annually  with  identification  of  any  systemic  or  repetitive  issues  needing  improvement, 
along  with  recommendations  for  corrective  action. 


2  The  newest  version  of  GAGAS  is  dated  December  2011.  However,  for  this  review  we  were  required  to  use  the  July  2007 
version  of  GAGAS,  as  it  covered  the  period  of  our  review,  October  1,  2010,  to  May  30,  2012. 
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The  DCMA  Audit  Manual,  chapter  1,  section  1.3,  dated  April  30,  2010,  states  that  the 
DCMA  IRT  adopted  the  Comptroller  General  auditing  standards  that  include  general 
standards  as  well  as  fieldwork  standards  and  reporting  standards  for  financial  and 
performance  audits.  The  DCMA  Audit  Manual,  chapter  1,  section  1.3,  dated  January  6, 
2012,  reiterates  the  same  statement  from  the  2010  version.  The  DCMA  IRT  Audit  Manual, 
chapter  3,  section  3.2,  II  (c),  dated  January  6, 2012,  states  the  supervisory  auditors  and  the 
executive  director  are  responsible  for  monitoring  audit  progress  to  ensure  that  auditors 
exercise  professional  judgment,  work  is  being  conducted  in  accordance  with  GAGAS 
and  DCMA  policies  and  procedures,  and  audit  findings  and  conclusions  are  adequately 
supported.  However,  this  statement  is  addressed  in  the  context  of  supervision  of  an  audit 
and  not  as  part  of  the  overall  monitoring  of  quality  control. 

Recommendations,  Comments,  and  Response 

A.l  Recommendation 

We  recommend  that  the  Director,  DCMA: 

Update  the  DCMA  IRT  Audit  Manual  to  include  policies  and  procedures  for  monitoring 
quality  in  the  audit  organization  at  least  annually. 

A.l  Management  Comments 

The  Director,  DCMA  concurred.  The  DCMA  IRT  Audit  Manual  is  being  revised  to  include 
the  policies  and  procedures  for  annual  monitoring  of  quality  control.  DCMA  IRT  plans  to 
review  all  completed  audits  for  compliance  with  GAGAS.  The  results  will  be  summarized 
and  communicated  to  all  Auditors. 

A.l  Our  Response 

DCMA  comments  were  responsive.  No  additional  comments  are  needed. 

A.l. a  Recommendation 

Prepare  a  2 -year  plan  for  performing  annual  quality  control  reviews  and  monitor  the 
progress  of  the  quality  control  plan. 


DODIG-2013-065  |  3 


Appendices 


A.l.a  Management  Comments 

The  Director,  DCMA  concurred.  DCMA  will  develop  a  2-year  plan  by  May  31, 2013,  that 
will  include  monitoring  of  all  audits  within  one  year  of  completion  and  reviewing  and 
updating  the  IRT  Audit  Manual  every  two  years.  DCMA  plans  to  use  CIGIE  checklists 
and  an  internally  developed  checklist  to  aid  in  identifying  deficiencies  and  other  areas 
on  noncompliance. 

A.l.a  Our  Response 

DCMA  comments  were  responsive.  No  additional  comments  are  needed. 

A.l.b  Recommendation 

Ensure  that  the  documentation  of  quality  control  reviews  is  maintained  so  that  they 
are  readily  available  for  review. 

A.l.b  Management  Comments 

The  Director,  DCMA  concurred.  DCMA  IRT  will  place  documentation  on  the  IRT  Portal 
which  is  electronically  accessible  to  only  IRT  auditors  at  the  completion  of  each  review. 

A.l.b  Our  Response 

DCMA  comments  were  responsive.  No  additional  comments  are  needed. 

A.l.c  Recommendation 

Track  and  monitor  the  progress  of  deficiencies  found  in  the  quality  control  reviews. 

A.l.c  Management  Comments 

The  Director,  DCMA  concurred.  DCMA  IRT  will  determine  the  cause  of  deficiencies 
and  take  efforts  to  ensure  they  are  not  repeated.  DCMA  IRT  will  place  a  sheet 
with  each  area  of  noncompliance  on  the  IRT  Portal  and  will  include  a  summary  of 
corrective  actions  and  its  progress.  The  tracking  sheet  will  be  placed  on  the  IRT  portal 
by  May  31,  2013. 

A.l.c  Our  Response 

DCMA  comments  were  responsive.  No  additional  comments  are  needed. 
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Independence 

For  two  audits,  Report  No.  DCMA-DMI-2010-001,  "Audit  of  DCMA  Training  Management 
Processes,"  August  20,  2010,  and  Report  No.  DCMA-DMI-2011-001,  "Audit  of  DCMA 
Telework  Program,"  November  29, 2011,  we  identified  issues  with  independence.  For  the 
Audit  of  DCMA  Telework  Program,  the  DCMA  IRT  relied  on  the  work  of  a  specialist  while 
performing  the  audit.  However,  there  was  no  evidence  or  audit  documentation  to  show 
that  the  DCMA  IRT  assessed  the  independence  of  the  specialist. 

GAGAS  3.05  states  that  when  auditors  use  the  work  of  a  specialist,  auditors  should  assess 
the  specialist’s  ability  to  perform  the  work  and  report  results  impartially  as  it  relates  to 
their  relationship  with  the  program  or  entity  under  audit.  If  the  specialist’s  independence 
is  impaired,  auditors  should  not  use  the  work  of  that  specialist. 

The  DCMA  Audit  Manual  dated  April  30, 2010,  did  not  have  policy  to  address  independence, 
and  specifically  did  not  have  policy  to  address  the  independence  of  specialist  at  the  time 
this  audit  was  performed.  In  addition,  the  DCMA  IRT  Audit  Manual  dated  April  30,  2010, 
chapter  1,  section  1.3,  does  not  specifically  address  the  independence  standard,  but  states 
that  the  DCMA  IRT  adopted  the  Comptroller  General  auditing  standards  that  include 
general  standards  as  well  as  fieldwork  standards  for  financial  and  reporting  standards. 

However,  the  DCMA  IRT  Audit  Manual,  chapter  1,  section  1.8  (c).,  dated  January  6,  2012, 
states  that  when  relying  on  the  work  of  nonauditors  (consultants,  experts,  specialists, 
etc.,  other  than  those  hired  to  assist  in  the  audit),  IRT  auditors  should  be  satisfied  as 
to  the  nonauditors  professional  reputation,  qualifications,  and  independence  from  the 
organization,  program,  activity,  or  function  being  audited.  This  new  policy  addresses 
independence,  and  this  section  of  the  policy  meets  GAGAS  requirements  that  DCMA  IRT 
auditors  should  assess  specialists  or  nonauditors  independence  and  qualifications. 

Also,  for  the  DCMA  Training  Management  Processes  Audit,  the  supervisory  auditor  did  not 
have  an  independence  statement  documented  in  the  audit  working  papers.  GAGAS  3.07 
states  that  auditors  participating  in  an  audit  assignment  must  be  free  from  personal 
impairments  to  independence. 

The  DCMA  Audit  Manual,  dated  April  30,  2010,  does  not  have  a  specific  policy  to  address 
the  independence  of  audit  personnel;  however,  the  Audit  Manual’s  Appendix  A  is  an 
independence  statement  form.  Further,  the  DCMA  Audit  Manual,  chapter  1,  section  1.5, 
dated  January  6,  2012,  states  that  the  IRT  and  its  staff,  including  contracted  audit 


DODIG-2013-065  |  5 


Appendices 


services  personnel  are  required  to  (i)  be  free  from  personal  and  external  impairments 
to  independence,  (ii)  be  organizationally  independent,  (iii)  maintain  an  independent 
attitude  and  appearance  in  all  matters  relating  to  audit  work,  and  (iv)  complete  the 
statement  of  independence  form. 

A.2  Recommendation 

We  recommend  that  the  Director,  DCMA: 

Assess  the  independence  of  any  specialists  or  nonauditors  tasked  to  perform  work  on  an 
audit  assignment  and  document  the  assessment  in  the  audit  files. 

A.2  Management  Comments 

The  Director,  DCMA  concurred.  DCMA  IRT  will  require  all  personnel  who  perform  work 
on  an  audit  assignment  to  complete  a  Statement  of  Independence  form.  DCMA  IRT  plans 
to  incorporate  this  requirement  in  the  revised  IRT  Audit  Manual  by  March  31,  2013. 

A.2  Our  Response 

DCMA  comments  were  responsive.  No  additional  comments  are  needed. 

A. 2.  a  Recommendation 

Require  the  supervisory  auditor  to  prepare  an  independence  statement  and  include 
it  with  the  audit  documentation  to  correspond  to  the  DCMA  IRT  January  2012  Audit 
Manual  requirements. 

A.2.a  Management  Comments 

The  Director,  DCMA  concurred.  The  supervisory  auditor  will  prepare  an  independence 
statement  for  all  audits.  DCMA  IRT  plans  to  include  this  requirement  on  the  internally 
developed  checklist  for  monitoring  of  completed  audits  to  ensure  compliance. 

A.2.a  Our  Response 

DCMA  comments  were  responsive.  No  additional  comments  are  needed. 
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Planning 

For  two  audits,  Audit  of  DCMA  Training  Management  Processes  and  Audit  of  DCMA 
Telework  Program,  we  identified  issues  with  audit  planning.  Specifically,  we  found 
that  both  audits  did  not  include  documentation  of  risk  of  fraud  during  audit  planning. 
In  addition,  for  one  of  the  audits  reviewed,  steps  to  the  audit  program  had  been  added 
without  obtaining  supervisory  approval. 

GAGAS  7.30  requires  auditors  to  assess  risks  of  fraud  occurring  that  are  significant  within 
the  context  of  the  audit  objectives.  The  DCMA  Audit  Manual,  section  3.15,  IV,  dated 
April  30, 2010,  states  that  while  reviewing  controls,  the  auditor  must  be  alert  to  situations 
or  transactions  that  could  be  indicative  of  fraud. 

DCMA  Audit  Manual,  chapter  2,  section  III,  (c)  (2),  dated  January  6,  2012,  states  that 
consistent  with  the  audit  objective,  the  lead  auditor  will  design  audit  steps  to  assess 
compliance  with  relevant  laws  and  regulations  and  to  provide  reasonable  assurance  of 
detecting  fraud,  abuse,  or  other  illegal  acts.  For  both  audits  reviewed,  we  did  not  identify 
any  working  papers  supporting  that  an  assessment  of  fraud  risks  had  been  performed 
during  audit  planning. 

For  the  audit  of  the  DCMA  Telework  Program,  steps  were  added  to  the  audit  program  to 
include  sampling  methodology  after  the  supervisor  had  approved  the  audit  program.  The 
steps  were  handwritten  into  the  audit  program;  therefore,  it  was  difficult  to  determine 
whether  the  supervisor  approved  the  audit  steps. 

GAGAS  7.51  states  that  a  written  audit  plan  provides  an  opportunity  for  the  audit 
organization  management  to  supervise  audit  planning  and  to  determine  whether: 

•  the  proposed  audit  objectives  are  likely  to  result  in  a  useful  report, 

•  the  audit  plan  adequately  addresses  relevant  risks,  and 

•  the  proposed  audit  scope  and  methodology  are  adequate  to  address  the 
audit  objectives. 

The  DCMA  Audit  Manual,  chapter  2,  section  2.3,  I  (a  and  b),  dated  April  30,  2010,  states 
that  the  supervisory  auditor,  as  a  second-level  supervisor  will  approve  overall  objectives 
and  audit  programs,  monitor  audit  programs  and  performance,  and  approve  requests  for 
deviation  from  the  approved  project  plan. 
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The  DCMA  Audit  Manual,  chapter  4,  section  4.2,  II  (e),  dated  January  6,  2012,  states 
that  the  supervisory  auditor  will  approve  any  changes  made  to  the  audit  program 
during  execution. 

A.3  Recommendation 

We  recommend  that  the  Director,  DCMA,  issue  a  memorandum  to  remind  DCMA  IRT  staff 
to  adhere  to  GAGAS  requirements  to  perform  and  document  fraud  risks  during  audit 
planning,  and  obtain  supervisory  review  and  approval  when  audit  programs  are  updated. 

A.3  Management  Comments 

The  Director,  DCMA  concurred.  The  Director,  DCMA  issued  a  memorandum  on  March  11, 
2013,  to  remind  the  DCMA  IRT  audit  staff  to  include  fraud  risks  in  the  planning  phase  of 
the  audit. 

A.3  Our  Response 

DCMA  comments  were  responsive.  No  additional  comments  are  needed. 

Audit  Documentation 

For  the  Audit  of  DCMA  Telework  Program,  the  audit  documentation  was  not  sufficient 
to  identify  why  part  of  the  initial  scope  of  the  review  was  dropped  for  review  during 
the  audit. 

GAGAS  7.77  states  that  auditors  must  prepare  audit  documentation  related  to  planning, 
conducting,  and  reporting  for  each  audit.  Further,  auditors  should  prepare  audit 
documentation  in  sufficient  detail  to  enable  an  experienced  auditor,  having  no  previous 
connection  to  the  audit,  to  understand  from  the  audit  documentation  the  nature,  timing, 
extent,  and  results  of  audit  procedures  performed;  the  audit  evidence  obtained  and  its 
source;  and  the  conclusions  reached,  including  evidence  that  supports  the  auditors’ 
significant  judgments  and  conclusions. 

DCMA  Audit  Manual,  chapter  4,  section  4.4,  II  (c)  (1),  dated  April  30,  2010,  states  that 
neatness  and  clarity  are  essential  elements  of  all  working  papers  to  develop  meaningful 
and  understandable  exhibits  and  schedules. 
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For  the  Audit  of  the  DCMA  Telework  Program,  the  original  scope  included  reviewing 
FY  2009  data;  however,  the  audit  documentation  did  not  clearly  identify  why  the  data 
were  not  reviewed.  The  auditors  prepared  a  working  paper  identifying  why  some  FY  2010 
data  were  not  able  to  be  reviewed,  but  they  did  not  address  in  the  working  paper  or  in 
other  documentation  why  the  FY  2009  data  were  not  reviewed. 

A.4  Recommendation 

We  recommend  that  the  Director,  DCMA,  issue  a  memorandum  to  remind  DCMA  IRT  staff 
to  adhere  to  GAGAS  for  preparing  audit  documentation  in  a  clear  and  concise  manner 
with  sufficient  detail  to  support  the  report. 

A.4  Management  Comments 

The  Director,  DCMA  concurred.  The  Director,  DCMA  issued  a  memorandum  on 
March  11,  2013,  to  remind  DCMA  IRT  audit  staff  to  adhere  to  GAGAS  when  preparing 
audit  documentation. 

A.4  Our  Response 

DCMA  comments  were  responsive.  No  additional  comments  are  needed. 

Quality  Control 

In  some  instances,  the  supporting  audit  documentation  for  the  Audit  of  DCMA  Telework 
Program  and  the  Audit  of  DCMA  Training  Management  Processes  was  difficult  to  locate 
in  the  working  papers.  In  addition,  audit  documentation  for  the  Audit  of  DCMA  Telework 
Program  did  not  show  whether  the  auditor  addressed  the  independent  referencer 
reviewer’s  comments  for  accuracy  of  the  report.  Although  we  located  support  for  the 
audit  reports,  improvement  in  referencing  and  documenting  changes  made  from  reviewer 
comments  was  needed. 

GAGAS  7.79  states  that  audit  documentation  is  an  essential  element  of  audit  quality.  The 
process  of  preparing  and  reviewing  audit  documentation  contributes  to  the  quality  of 
an  audit.  Audit  documentation  serves  to  provide  the  principal  support  for  the  auditors’ 
report,  aid  auditors  in  conducting  and  supervising  the  audit,  and  allow  for  the  review  of 
audit  quality. 

The  DCMA  Audit  Manual,  chapter  5,  section  II,  5.8(f)  (3),  dated  April  30,  2010,  states  that 
when  the  review  is  independently  referenced,  the  auditor  will  respond  to  each  referencing 
note  indicating  agreement  or  disagreement  and  specify  the  actions  that  have  been  taken 
or  will  be  taken  to  correct  the  discrepancy. 
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A.5  Recommendation 

We  recommend  that  the  Director,  DCMA,  issued  a  memorandum  to  remind  DCMA  IRT 
staff  to  comply  with  the  DCMA  IRT  Audit  Manual  to  independently  reference  audit  reports 
and  ensure  that  the  referencer’s  comments  or  concerns  are  addressed  and  documented 
before  report  issuance. 

A.5  Management  Comments 

The  Director,  DCMA  concurred.  The  Director,  DCMA  issued  a  memorandum  on  March  11, 
2013,  to  remind  DCMA  IRT  audit  staff  to  independently  reference  audit  reports  and 
ensure  that  the  referencer’s  comments  or  concerns  are  addressed  and  documented  before 
report  issuance. 

A.5  Our  Response 

DCMA  comments  were  responsive.  No  additional  comments  are  needed. 


10  |  DODIG-2013-065 


Appendices 


Appendix  B 

Monitoring  of  Independent  Public  Accountants 

We  reviewed  the  DCMA  IRT  monitoring  of  audit  work  performed  by  an  Independent 
Public  Accountant  (IPA)  for  Report  No.  DCMA-DMI-2012,  "Review  of  the  DCMA's  Use 
of  the  Defense  Travel  System,"  May  24,  2012.  While  the  monitoring  of  the  IPA  was  not 
subject  to  GAGAS,  we  reviewed  one  of  the  engagements  as  it  was  a  significant  part  of  the 
DCMA’s  internal  review  activities. 

We  identified  the  following  deficiencies: 

•  The  DCMA  IRT  did  not  have  a  plan  or  oversight  policy  in  place  for  reviewing 
the  contracts.  The  auditors  did  take  appropriate  steps  in  monitoring  the 
contract,  such  as  reviewing  deliverables  and  ensuring  that  the  deliverables 
were  obtained  in  accordance  with  the  terms  of  the  contract,  but  a  plan  was  not 
in  place  to  ensure  that  the  auditors  followed  appropriate  steps  for  monitoring. 

•  An  auditor  was  added  to  the  contract  after  award  without  an  assessment 
of  qualifications.  The  audit  team  should  obtain  information  on  all  auditors 
assigned  to  the  audit  to  ensure  that  they  are  independent  and  qualified. 

•  The  auditors  had  a  copy  of  the  last  peer  review  upon  contract  award,  but 
the  peer  review  was  almost  3  years  old  and  they  did  not  obtain  or  ask  for 
the  annual  summary  of  results  of  its  monitoring  procedures.  The  CIGIE 
Appendix  F  states  that  for  peer  review  reports  older  than  1  year,  the  auditors 
may  also  consider  obtaining  additional  information  about  the  IPA’s  system 
of  quality  control;  for  example,  the  IPA’s  annual  summary  of  the  results  of  its 
monitoring  procedures.  When  the  contract  was  awarded  in  2011,  the  last 
peer  review  was  dated  December  1,  2008. 

•  The  auditors  did  not  put  a  copy  of  the  finalized  report  in  the  TeamMate3  file. 
The  auditors  should  document  information  for  the  contract  to  include  the 
final  report. 


3  TeamMate  is  the  electronic  audit  management  system  that  DCMA  IRT  uses  to  prepare  and  store  their  working  papers, 
findings,  documentation  supporting  analysis  and  conclusions,  and  audit  reports.  Additional  TeamMate  information  can  be 
found  at  www.cchteammate.com. 
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B.l  Recommendation 

We  recommend  that  the  Director,  DCMA: 

Prepare  a  comprehensive  plan  for  overseeing  contracted  auditing  services.  The  plan 
should  document  the  oversight  review,  the  level  of  review,  oversight  strategies,  and 
monitoring  procedures. 

B.l  Management  Comments 

The  Director,  DCMA  concurred.  DCMA  IRT  will  develop  a  comprehensive  plan  for 
overseeing  contracted  audit  services  and  include  procedures  from  DOD  IG’s  Report  No. 
D-2009-6-003,  "Key  Strategies  and  Practices  for  Oversight  of  DOD  Contracted  Audit 
Services,"  March  3,  2009.  DCMA  IRT  will  include  the  plan  in  the  revised  IRT  Audit  Manual 
by  March  31,  2013. 

B.l  Our  Response 

DCMA  comments  were  responsive.  No  additional  comments  are  needed. 

B.l. a  Recommendation 

Ensure  oversight  procedures  include  obtaining  the  latest  quality  control  report  prior 
to  awarding  the  contract. 

B.l. a  Management  Comments 

The  Director,  DCMA  concurred.  DCMA  IRT  will  ensure  that  latest  quality  control 
report  is  used  prior  to  awarding  a  contract  for  audit  services.  DCMA  IRT  plans  to 
include  this  procedure  in  the  revised  IRT  Audit  Manual  by  March  31,  2013. 

B.l. a  Our  Response 

DCMA  comments  were  responsive.  No  additional  comments  are  needed. 
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B.l.b  Recommendation 

Continually  monitor,  assess,  and  document  the  qualifications  of  the  audit  staff  assigned 
to  the  audit  to  make  sure  that  the  GAGAS  competency  standard  is  followed. 

B.l.b  Management  Comments 

The  Director,  DCMA  concurred.  DCMA IRT  plans  that  the  COTR  (Contracting  Officer’s 
Technical  Representative)  will  request  and  determine  if  the  new  auditors  assigned 
to  the  contract  are  qualified  to  be  on  the  audit  team.  DCMA  IRT  plans  to  include  this 
procedure  in  the  revised  IRT  Audit  Manual. 

B.l.b  Our  Response 

DCMA  comments  were  responsive.  No  additional  comments  are  needed. 
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Appendix  C 


Summary  of  Interview  Results  Relating  to  DCMA  Audit 
Policies  and  GAGAS 

We  interviewed  the  DCMA  IRT  supervisory  auditor  and  five  staff  members  to  determine 
their  knowledge  of  DCMA  audit  policies  and  GAGAS.  The  interviews  consisted  of  questions 
related  to  the  DCMA  IRT  audit  policies  and  GAGAS  general,  fieldwork,  and  reporting 
standards.  The  following  table  contains  a  summary  of  the  results  of  the  responses  received. 


Areas  Pertaining  to  DCMA 

Office  of  Internal  Audit  Policies  Staff  Responses  to  Questions 
and  GAGAS  Standards 


Areas  Pertaining  to  DCMA 
Office  of  Internal  Audit  Policies 
and  GAGAS  Standards 

Staff  Responses  to  Questions 

Awareness  of  DCMA  IRT  Policies 

All  staff  stated  they  were  aware  of  the  audit  policies. 

Compliance  with  GAGAS 

All  staff  stated  that  their  work  complied  with  GAGAS  standards. 

Independence 

Several  of  the  audit  staff  expressed  concerns  with 
organizational  independence.  We  reviewed  those  concerns  and 
determined  that  an  organizational  independence  impairment 
did  not  exist. 

Competence 

Staff  responses  indicated  that  the  competency  requirement 
was  fulfilled.  Several  audit  staff  expressed  concern  about  audit 
qualifications  and  meeting  continuing  professional  education 
requirements  for  audit  management.  We  reviewed  those 
concerns  and  determined  continuing  professional  education 
requirements  were  met. 

Quality  Control  and  Assurance 

Staff  members  were  knowledgeable  about  quality  control  and 
assurance  procedures. 

Planning  (Key  Decisions) 

Staff  involved  with  planning  stated  that  they  documented 
key  decisions. 

Planning  (Fraud) 

Staff  involved  with  audit  planning  stated  that  they  were 
preparing  fraud  assessment  working  papers  on  the 
newer  audits. 

Supervision 

All  staff  stated  that  they  received  or  provided 
adequate  supervision. 

Audit  Documentation 

All  staff  stated  that  the  audit  documentation  was  adequate. 

Evidence 

The  staff  stated  that  the  evidence  was  adequate. 

Reporting  (Timeliness) 

The  audit  staff  stated  that  the  reports  had  quick  turnaround 
times  for  completion  and  were  timely. 
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Appendix  D 

Scope  and  Methodology 

We  reviewed  the  adequacy  of  the  DCMA IRT  compliance  with  quality  policies,  procedures, 
and  standards.  In  performing  our  review,  we  considered  the  requirements  of  quality 
control  standards  contained  in  the  July  2007  Revision  of  GAGAS  issued  by  the  Comptroller 
General  of  the  United  States.  GAGAS  3.56  states: 

The  audit  organization  should  obtain  an  external  peer  review 
sufficient  in  scope  to  provide  a  reasonable  basis  for  determining 
whether,  for  the  period  under  review,  the  reviewed  audit 
organization’s  system  of  quality  control  was  suitably  designed 
and  whether  the  audit  organization  is  complying  with  its  quality 
control  in  order  to  provide  the  audit  organization  with  reasonable 
assurance  of  conforming  with  applicable  professional  standards. 

We  performed  this  review  from  April  2012  to  October  2012  in  accordance  with  standards 
and  guidelines  established  in  the  March  2009  CIGIE  Guide  for  Conducting  External  Peer 
Reviews  of  the  Audit  Organizations  of  Federal  Offices  of  Inspector  General.  We  performed 
this  review  in  accordance  with  the  Quality  Standards  for  Inspections  and  Evaluations. 
In  performing  this  review,  we  assessed,  reviewed,  and  evaluated  audit  documentation; 
interviewed  DCMA  IRT  auditors,  and  reviewed  DCMA  IRT  policies  that  were  published  on 
April  30,  2010,  and  January  6,  2012. 

We  judgmentally  selected  three  reports  from  a  universe  of  five  reports  issued  by  the 
DCMA  IRT  during  the  period  of  October  1,  2010,  to  May  30,  2012.  In  selecting  reports,  we 
worked  with  the  DCMA  IRT  to  establish  the  universe  of  reports  that  were  issued  during 
the  review  period.  We  then  selected  audits  that  were  more  recent  to  review  the  most 
current  quality  assurance  procedures  being  used,  and  we  chose  a  variety  of  audits  to 
ensure  we  reviewed  multiple  types  of  projects. 

The  following  table  identifies  the  specific  reports  reviewed.  The  Type  of  Review  column 
contains  information  that  was  determined  by  the  report  GAGAS  compliance  statement 
and/or  the  type  of  review  described  in  the  final  report. 
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Report  Number 

Report  Title  and  Issue  Date 

Type  of  Review 

DCMA-DM 1-2011-001 

Audit  of  DCMA  Telework 
Program,  November  29,  2011 

Performance 

Audit  of  DCMA  Training 

DCMA-DM 1-2010-001 

Management  Processes, 

August  20,  2010 

Performance 

Review  of  the  DCMA's  Use  of 

DCMA-DM  1-2012-2 

the  Defense  Travel  System, 

May  24,  2012 

Contract 

Our  review  would  not  necessarily  disclose  all  weaknesses  in  the  system  of  quality 
control  or  all  instances  of  noncompliance  because  we  based  our  review  on  selective  tests. 
There  are  inherent  limitations  in  considering  the  potential  effectiveness  of  any  quality 
control  system.  In  performing  most  control  procedures,  departures  can  result  from 
misunderstanding  of  instructions,  mistakes  of  judgment,  carelessness,  or  other  human 
factors.  Projecting  any  evaluation  of  a  quality  control  system  into  the  future  is  subject  to 
the  risk  that  one  or  more  procedures  may  become  inadequate  because  conditions  may 
change  or  the  degree  of  compliance  with  procedures  may  deteriorate. 
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Comments 


Defense  Contract  Management  Agency 


DEFENSE  CONTRACT  MANAGEMENT  AGENCY 

3901  A  AVENUE.  BUILDING  10500 
FORT  LEE.  VIRGINIA  23801-1809 

MAR  1  2  2013 


MEMORANDUM  FOR  DEPARTMENT  OF  DEFENSE,  OFFICE  OF  INSPECTOR 

GENERAL,  DEPUTY  INSPECTOR  GENERAL,  POLICY  AND 
OVERSIGHT 

SUBJECT:  Quality  Control  Review  of  the  Defense  Contract  Management  Agency  Internal 
Review  Audit  Function  (Project  No.  20 12-DIP0AI-0 138.000) 

This  is  in  response  to  your  February  12,  2013  report  on  Quality  Control  Review  for  the 
Defense  Contract  Management  Agency  Internal  Review  Audit  Function.  Attached  are  the 
management  comments  to  address  the  recommendations. 

Please  direct  any  comments  or  questions  to  Ms.  Diana  P.  Graff,  Executive  Director,  Office 
of  Independent  Assessment.  (804)  734-2597,  Diana.Graff@dcma.mil. 


Attachments: 
As  stated 

Cc: 

USD(AT&L) 

ASD(A) 
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DCMA  Comments  to  DODIG  Quality  Control  Review  of  the 
Defense  Contract  Management  Agency  Internal  Review  Audit 
Function  (DODIG  Audit  Report  No.  2012-DIP0AI-0138.000) 

Recommendations 

We  recommend  that  the  Director,  DCMA: 

1 .  Update  the  DCMA  IRT  Audit  Manual  to  include  policies  and  procedures  for 
monitoring  quality  in  the  audit  organization  at  least  annually. 

DCMA  Comments:  Concur.  The  DCMA  IRT  Audit  Manual  is  being  revised  and  will 
include  policies  and  procedures  for  annual  monitoring  of  quality  control.  All  completed 
audits  will  be  reviewed  to  determine  compliance  with  Government  Auditing  Standards 
and  the  IRT  Audit  Manual.  Results  will  be  summarized,  systemic  or  repetitive  issues 
identified,  and  communicated  to  all  Auditors.  The  manual  is  expected  to  be  completed 
by  March  31, 2013. 

2.  Prepare  a  2-year  plan  for  performing  annual  quality  control  reviews  and  monitor  the 
progress  of  the  quality  control  plan. 

DCMA  Comments:  Concur.  A  2-year  plan  is  being  developed  and  will  include 
monitoring  ol  all  audits  within  one  year  of  completion  and  reviewing  and  updating  the 
IRT  Audit  Manual  every  two  years.  The  CIGIE  checklist  and  an  internally  developed 
checklist  will  be  used  to  aid  in  identifying  deficiencies  and  other  areas  of  noncompliance. 
The  plan,  completed  checklist,  and  summary  of  monitoring  will  be  placed  on  the  IRT 
Portal  near  the  Annual  Audit  Plan.  The  monitoring  plan  will  be  reviewed  annually  in 
conjunction  with  development  of  the  Audit  Plan.  Estimated  completion  of  the 
monitoring  plan  is  May  31,  2013. 

3.  Ensure  that  the  documentation  of  quality  control  reviews  is  maintained  so  that  they  are 
readily  available  for  review. 

DCMA  Comments:  Concur.  At  the  completion  of  each  review,  documentation  will  be 
placed  on  the  IRT  Portal  which  is  electronically  accessible  to  only  IRT  auditors. 

4.  Track  and  monitor  the  progress  of  deficiencies  found  in  the  quality  control  reviews. 

DCMA  Comments:  Concur.  As  deficiencies  are  identified,  the  cause  will  be 
determined  and  efforts  taken  to  ensure  they  are  not  repeated.  A  sheet  with  each  area  of 
noncompliance  will  be  placed  on  the  IRT  Portal  and  will  include  a  summary  of  corrective 
actions  and  its  progress.  The  Tracking  sheet  will  be  placed  on  the  IRT  Portal  by  May  31, 
2013. 

5.  Assess  the  independence  of  any  specialists  or  nonauditors  tasked  to  perform  work  on 
an  audit  assignment  and  document  the  assessment  in  the  audit  files. 
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DCMA  Comments  to  DODIG  Quality  Control  Review  of  the 
Defense  Contract  Management  Agency  Internal  Review  Audit 
Function  (DODIG  Audit  Report  No.  2012-DIP0AI-0138.000) 


DCMA  Comments:  Concur.  IRT  will  require  all  personnel  who  perform  work  on  an 
audit  assignment  to  complete  a  Statement  of  Independence  form.  The  revised  IRT  Audit 
Manual  will  include  this  requirement.  Estimated  completion  of  the  Manual  is  May  3 1 , 
2013. 

6.  Require  the  supervisory  auditor  to  prepare  an  independence  statement  and  include  it 
with  the  audit  documentation  to  correspond  to  the  DCMA  IRT  January  2012  Audit 
Manual  requirements. 

DCMA  Comments:  Concur.  The  supervisory  auditor  will  prepare  an  independence 
statement  for  all  audits.  To  ensure  compliance,  this  will  be  included  on  the  internally 
developed  checklist  for  monitoring  of  completed  audits. 

7.  We  recommend  that  the  Director,  DCMA,  issue  a  memorandum  to  remind  DCMA  IRT 
staff  to  adhere  to  GAGAS  requirements  to  perform  and  document  fraud  risks  during  audit 
planning,  and  obtain  supervisory  review  and  approval  when  audit  programs  are  updated. 

DCMA  Comments:  Concur.  A  memorandum  signed  by  me  on  March  11, 2013  reminds 
IRT  staff  to  include  fraud  risks  in  the  planning  phase  of  the  audit.  IRT  has  begun 
documenting  fraud  risks  during  the  planning  phase  of  their  audits. 

8.  We  recommend  that  the  Director,  DCMA,  issue  a  memorandum  to  remind  DCMA  IRT 
staff  to  adhere  to  GAGAS  for  preparing  audit  documentation  in  a  clear  and  concise 
manner  with  sufficient  detail  to  support  the  report. 

DCMA  Comments:  Concur.  A  memorandum  signed  by  me  on  March  1 1,  2013  reminds 
Auditors  to  adhere  to  GAGAS  when  preparing  audit  documentation. 

9.  We  recommend  that  the  Director.  DCMA,  issue  a  memorandum  to  remind  DCMA  IRT 
staff  to  comply  with  the  DCMA  IRT  Audit  Manual  to  independently  reference  audit 
reports  and  ensure  that  the  referencef  s  comments  or  concerns  are  addressed  and 
documented  before  report  issuance. 

DCMA  Comments:  Concur.  A  memorandum  signed  by  me  on  March  1 1, 2013 
reminds  IRT  staff  to  independently  reference  audit  reports  and  ensure  referencef  s 
comments/concerns  are  addressed  and  documented  prior  to  report  issuance. 

1 0.  Prepare  a  comprehensive  plan  for  overseeing  contracted  auditing  services.  The  plan 
should  document  the  oversight  review,  the  level  of  review,  oversight  strategies,  and 
monitoring  procedures. 
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Comments 


DCMA  Comments  to  DODIG  Quality  Control  Review  of  the 
Defense  Contract  Management  Agency  Internal  Review  Audit 
Function  (DODIG  Audit  Report  No.  2012-DIP0AI-0138.000) 

DCMA  Comments:  Concur.  A  comprehensive  plan  for  overseeing  contracted  auditing 
services  is  being  developed  and  will  includes  procedures  that  are  in  DoD  IG’s  report  on 
“Key  Strategies  and  Practices  for  Oversight  of  DoD  Contracted  Audit  Services”.  The 
plan  will  be  included  in  the  revised  IRT  Audit  Manual  which  is  estimated  to  be 
completed  by  March  31,  2013. 

1 1 .  Ensure  oversight  procedures  include  obtaining  the  latest  quality  control  report  prior  to 
awarding  the  contract. 

DCMA  Comments:  Concur.  IRT  will  ensure  the  latest  quality  control  report  is  used 
prior  to  awarding  a  contract  for  audit  services.  This  procedure  will  be  included  in  the 
revised  IRT  Audit  Manual  which  is  estimated  to  be  completed  by  March  31,  2013. 

12.  Continually  monitor,  assess,  and  document  the  qualifications  of  the  audit  staff 
assigned  to  the  audit  to  make  sure  that  the  GAGAS  competency  standard  is  followed. 

DCMA  Comments:  Concur.  The  qualification  of  audit  staff  is  determined  during  the 
source  selection  process.  As  new  Auditors  are  assigned  to  the  contract,  the  COTR  will 
request  and  determine  if  they  are  qualified  to  be  on  the  audit  team.  This  procedure  will 
be  included  in  the  revised  IRT  Audit  Manual  which  is  estimated  to  be  completed  by 
March  31,  2013. 
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Acronyms  &  Abbreviations 


Acronyms  and  Abbreviations 

CIGIE  Council  of  the  Inspectors  General  on  Integrity  and  Efficiency 
DCMA  Defense  Contract  Management  Agency 
GAGAS  Generally  Accepted  Government  Audit  Standards 
IPA  Independent  Public  Accountants 
IRT  Internal  Review  Team 
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Whistleblower  Protection 
U.S.  Department  of  Defense 


The  Whistleblower  Protection  Enhancement  Act  of  2012  requires 
the  Inspector  General  to  designate  a  Whistleblower  Protection 
Ombudsman  to  educate  agency  employees  about  prohibitions  on 
retaliation,  and  rights  and  remedies  against  retaliation  for  protected 
disclosures.  The  designated  ombudsman  is  the  DoD  IG  Director  for 
Whistleblowing  &  Transparency.  For  more  information  on  your  rights 
and  remedies  against  retaliation,  go  to  the  Whistleblower  webpage  at 
www.dodig.mil/programs/whistleblower. 


For  more  information  about  DoD  IG 
reports  or  activities,  please  contact  us: 

Congressional  Liaison 

Congressional@dodig.mil;  703.604.8324 

DoD  Hotline 

800.424.9098 

Media  Contact 

Public.Affairs@dodig.mil;  703.604.8324 

Monthly  Update 

dodigconnect-request@listserve.com 

Reports  Mailing  List 

dodig_report-request@listserve.com 

Twitter 

twitter.com/DoD_IG 


